Active Directory Aggregation adding DOMAIN\ to Entitlement Display Names

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.4p1

I did a fresh group aggregation for my lower environment and have seen it aggregate groups into the application with the format of DOMAIN/DisplayName.

This hasnt happened before and I am not aware of any configuration changes. Is there a way I can prevent this?

I have exported the entitlement catalog and changed them, but my roles are all showing disconnected groups because of it.

2

@Alyson_Trad Can you share the screenshot or the format? Old format and new format of the entitlement value.

3

This is controlled by how your Active Directory group schema is configured. For example this is the group schema setup for me. Once groups are aggregated in SailPoint I have entitlement displayName set to msDS-PrincipalName which will be of format domain\displayName while value attribute for the ManagedAttribute is set to distinguishedName of the AD group

image
image1498×711 23.8 KB

image
image1020×598 29.6 KB

For your issue with roles please check how are your role profiles are configured. It should usually have the AD group DN which is the value of the entitlement (Managed Attribute)